关于通过CloudTrail查询Lambda删除事件的技术问询

Hey Chris, sorry to hear your Lambda vanished post-production—let’s get to the bottom of this quickly!

You’re totally on the right track focusing on the Event Name property in CloudTrail. That’s the most direct way to track Lambda deletion events. Here’s exactly what you need to know:

• Critical Event Names to Search: Look for either DeleteFunction (the modern API version) or DeleteFunction20150331v2 (the legacy API call). Both correspond to Lambda function deletions, so check for both to cover all bases.
• Step-by-Step Console Filtering:
  1. Navigate to the CloudTrail service in your AWS Console.
  2. Go to the "Events" section.
  3. Use the filter bar to search for Event name: DeleteFunction or Event name: DeleteFunction20150331v2.
• Narrow Down Results Efficiently:
  • Add a Resource name filter with your Lambda function’s exact name (or ARN) to skip unrelated events.
  • Check the Username field to identify who/what initiated the deletion—this could be an IAM user, a service role, or even a deployment tool like CloudFormation.
  • Use the Event time filter to match the window when you noticed the Lambda disappeared.
• CLI Example (for command-line users):
  If you prefer using the AWS CLI, run this command to pull relevant events (adjust the time window to match your production release timeline):

  aws cloudtrail lookup-events \
    --lookup-attributes AttributeKey=EventName,AttributeValue=DeleteFunction \
    --start-time 2024-05-01T00:00:00Z \
    --end-time 2024-05-01T23:59:59Z
  

One extra tip: If your Lambda was part of a CloudFormation stack, the deletion might be a side effect of a stack update or removal. You should also check for DeleteStack events in CloudTrail, as some deployment tools trigger stack deletions that take the Lambda with them.

Once you find the matching event, click into it to view full details: the caller ARN will tell you exactly what entity triggered the deletion, and the request parameters will confirm the target function. That should give you the complete picture of why your Lambda disappeared.

Hope this helps you resolve the issue fast!

内容来源于stack exchange